General
-
Target
D5EA5EC6D3DD740D1D8B6B817A667094.exe
-
Size
75KB
-
MD5
d5ea5ec6d3dd740d1d8b6b817a667094
-
SHA1
f75cffadf0cb8c7afac041d42d7beb416474e96a
-
SHA256
c9bd849cb30e63f3fa72d83b52303b21f3a880a5e7c6236e38a92dc078467e8d
-
SHA512
c4cc9305e6d10ef16860c6f3c1a29dd0377d2946e5c17dd7cb4d8ec56d262840ee9530c542e82ac337e0abe558e0fe3c58465d11652a9feb1a6fba6494e2d2a8
-
SSDEEP
1536:5ZuhD5z28TC2qM/AEc7s1PsYTgbSUPH4Lb0tY4:eNoEc7suugbSKHaboY4
Score
10/10
Malware Config
Extracted
Family
blacknet
Botnet
HacKed
C2
http://op.mrstealth.pagekite.me
Mutex
BN[eZOiZQdo-5530693]
Attributes
-
antivm
true
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
35dcbc7eb742dd4f1edfbccf7826c724
-
startup
false
-
usb_spread
false
Signatures
-
BlackNET payload 1 IoCs
-
Blacknet family
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
D5EA5EC6D3DD740D1D8B6B817A667094.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections